JP3070859B2 - Environmentally resistant electronic devices - Google Patents

Description

DETAILED DESCRIPTION OF THE INVENTION [Industrial Application Field] The present invention relates to an environment-resistant electronic device mounted on a spacecraft (artificial satellite, spacecraft, space station, etc.) or a robot for a nuclear reactor placed in a radiation environment. In particular, the present invention relates to an environment-resistant electronic device suitable for reduction in size, weight, power consumption, and price.

[Prior Art] With the expansion of the range of activities of mankind, for example, environment-resistant electronic devices such as computers that operate accurately even in extreme environments with a high radiation dose, such as in space or in nuclear reactors, are required. Electronic devices such as semiconductor integrated circuits that operate in a radiation environment must have transient-dose resistance.
Malfunctions due to the effects of radiation increase, making it impractical. Transient dose is a phenomenon that occurs temporarily due to the action of incident radiation or secondary charged particles, such as single-event upsets that change the data in memory or CMOS-ICs. There is a latch-up in which a parasitic thyristor is turned on and a large current flows between power supply grounds. Since this phenomenon hinders the normal operation of the electronic device and impairs the reliability and continuity of the operation, it is necessary to take a transient dose countermeasure for the electronic device used in a radiation environment.

Conventional technologies for transient dose countermeasures include: (1) A method to respond at the system level using fault-tolerant technology (Document "Model for researching control devices for space stations using V60", 32-bit microprocessor application, development, and evaluation) , Pp95-124, Nikkei Tuna Hill,
April 20, 1988, and the document "Development of a computer with a fault-tolerant artificial satellite", IEICE Technical Report on Space Navigation Electronics SANE86-43).

(2) A method for imparting transient dose resistance to the IC itself.

There are two.

FIG. 12 is a configuration diagram of an environment-resistant electronic device in which a transient dose countermeasure has been taken at a system level. This environment-resistant electronic device has a redundant configuration in which the device 1 is N-folded, and each of the redundant systems 1-1 to 1 having the same function and performing the same processing.
-N is connected by the system bus 6, and even if a part of the redundant system malfunctions due to the influence of the transient dose, the adverse effect of the malfunction is eliminated by masking with another normally operating redundant system. Things. FIG. 13 is a configuration diagram of another conventional environment-resistant electronic device. In the conventional example of FIG. 12, each redundant system is connected by a system bus 6, whereas in the conventional example of FIG. 13, each of the redundant systems 1-1 to 1-N is connected to a control circuit 5 by a communication path 8. To obtain the final output 10 from the control circuit 5. The control circuit 5 includes an output switching circuit, a majority decision circuit, and the like.

In addition, as a conventional measure to make the CMOS-IC itself have transient dose resistance, (1) Measures against latch-up a. Use a circuit with a static configuration b. Enhance guard band (Japanese Patent Laid-Open No. 55-141751) c. Increasing the distance between transistors d. SOI (Silicon on Insulator) and SOS (Silicon on Sap
hire) (2) Single event upset countermeasures a. Increase in critical charge (low integration) b. Use of SOI and SOS.

[Problems to be Solved by the Invention] The above-described conventional techniques have not yet solved the following problems.

(I) Problems of multiplexed electronic device: As shown in FIG. 14, redundant system 1-i connecting output to bus 6
If the latch-up occurs in the logic gate 107-i (often a three-state buffer), the output value of the logic gate 107-i is not guaranteed (in many cases,
Since the transistor is turned on and the power supply voltage is reduced due to the short-circuit current and is fixed at the low level, an abnormal signal is output to the bus 6. That is, the logic gate
The bus 6 does not operate normally due to the latch-up of 107-i, and the other redundant system 1-j cannot use the bus 6.
In particular, if a latch-up occurs in a logic gate outputting a communication control signal, the effect will affect the entire system. For example, if the communication request signal remains output to the communication control signal line due to the occurrence of latch-up, the other redundant system cannot perform other processing due to the interrupt processing by the request signal, and may cause a system down. Occurs. Such an erroneous communication control signal is generated not only by the above-described latch-up at the logic gate 107-i, but also by a malfunction due to a single event upset of the interface unit for controlling communication. This problem also occurs when the redundant systems are connected by means other than the bus.

Next, consider a case where latch-up occurs in the logic gate 109 while the output signal 110 of the logic gate 108 is being input to the logic gate 109 as shown in FIG. In this case, there is no direct effect on the logic gate 108 due to the latch-up of the logic gate 109. However, in order to recover the logic gate 109 from latch-up, it is necessary to temporarily turn off the power of the logic gate 109 and then turn it on again after a predetermined time. However, when the power supply is turned on again, as shown in FIG. 16, when the output signal of the logic gate 108 is at a high level, the input potential of the logic gate 109 is higher than the power supply voltage, so that the logic gate 109 is Latch-up occurs again. To prevent the latch-up of the logic gate 109 from recurring: (1) While the power of the logic gate 109 is shut off, the value of the output signal of the logic gate 108 is forced to a low level.

(2) Shut off the power supply of the whole system and turn on the power supply again.

There is a method. Considering that latch-up may occur simultaneously in all logic gates,
When the method of (1) is adopted, there is a problem that a function must be provided for forcibly setting the values of the output signals of all the logic gates to a low level. In addition, when the method (2) is adopted, the power of the entire system must be shut off, so that there is a problem that the operation of the entire system is stopped while the power is shut off. That is, the system is stopped every time latch-up occurs, and the continuity of the processing is impaired.

(II) Problems with an electronic device having a single part (single part in FIG. 13): In a multiplexed electronic device having a single part, a single event upset occurred in the single part. If
There is a problem that the effect appears on the output signal 10.

(III) Problems when CMOS-IC itself has transient dose resistance: When CMOS-IC itself has transient dose resistance, the degree of integration of elements is reduced and the chip area is increased. . In order to increase the critical charge, the size of each element is increased, that is, the degree of element integration is reduced. Decreasing the degree of element integration and increasing the chip area increases power consumption and processing speed, while increasing the weight of the electronic device.

To summarize the above-mentioned problems of the prior art, it is necessary to increase the number of redundant systems in order to improve the reliability of environment-resistant electronic devices. However, it is necessary to increase the chip area of the CMOS-IC constituting each redundant system. Therefore, there is a problem in that the overall configuration becomes large and the configuration must be such that the influence of the single event phenomenon does not spread to the entire system.

Since environmentally resistant electronic devices are used in extreme environments, such as in space or in nuclear reactors, the key is to reduce the size and weight. For example, considering the cost of launching into satellite orbit, a device that is as light as 1 gram can be used. Need to be manufactured. To this end, it is necessary to increase the degree of integration of the element to reduce the size and weight. However, as described above, the degree of integration of the element must be reduced for transient dose resistance. That is,
In the conventional environment-resistant electronic device, the result of technological progress in the direction of high-density integration of elements cannot be applied, which means that another technological development has to be advanced.
Also, there is very little demand for electronic devices that have been subjected to measures for transient dose resistance, and the operating rate of these manufacturing facilities is extremely low at present. Therefore, there is a problem that the manufacturing cost of the environment-resistant electronic device becomes extremely high.

A first object of the present invention is to reduce the size and weight at low cost by applying the recent high integration technology, and furthermore, to provide an environmental resistance which does not affect the entire system due to the effects of transient dose. An electronic device is provided.

A second object of the present invention is to provide an environment-resistant electronic device that can maintain continuity of system operation without shutting off the power supply of the entire system when latch-up occurs.

[Means for Solving the Problems] The first object of the present invention is to provide an environment-resistant electronic device having a multiplexed redundant system in addition to a single unit composed of elements formed by a process in which measures against transient dose are taken. The interface unit for connecting the redundant system or between the redundant system and the single unit among the constituent units of each redundant system is constituted by an element by a process in which a measure against transient dose is taken, and the interface unit of each redundant system is provided. The other components are constituted by the elements by the process not taking the transient dose measure, and the element integration degree of the components constituted by the elements by the process without the measure of the transient dose of each of the redundant systems is changed by the transient factor. It is M times as high as the element integration degree of a component constituted by an element formed by a process that has taken a dose countermeasure, and the redundant transformer Gent
This is attained by using an N-fold configuration (N <M) for compensating the reliability of a component configured by an element formed by a process that does not take a dose measure.

The second object is to provide a power supply control unit that shuts off the power supply for all or a part of a redundant system related to the latch-up or for each element when a latch-up occurs, and turns the power on again after a predetermined time. Achieved.

[Operation] By taking measures against transient dose for each of the redundant system interfaces, it is possible to prevent the transient dose from spreading to the entire system. In addition, by using a non-transient dose countermeasure unit at a location other than the interface unit, it is possible to highly integrate the non-transient dose countermeasure unit. By doing so, the reliability can be compensated for, and it is possible to reduce the size and weight.

By providing means for turning off and on the power at each latch-up occurrence point, it is not necessary to stop the entire operation of the system every time the latch-up occurs.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

In a fault-tolerant system consisting of multiplexed redundant systems, measures must be taken for transient doses of the redundant system elements that are connected to other redundant systems or a single part, and the elements that form the single part. This prevents abnormal signal output to the bus due to latch-up, re-occurrence of latch-up when power is turned on again, and the effects of a single event upset in a single unit. The effect of transient dose on the part of the redundant system where transient dose measures are not applied is prevented by fault-tolerant technology. Of the elements constituting the environment-resistant electronic device, by limiting the elements that are subjected to the transient dose countermeasure, the other parts are multiplexed and highly integrated,
Reduce the size, weight, power consumption, and speed of the entire system.

Here, for example, the effect of reducing the chip area when a memory device is multiplexed while increasing the degree of integration by a high integration technology will be described by increasing specific numerical values.

The immunity of the memory device to transient doses, i.e., the immunity to single event upsets and latch-ups, decreases as the degree of integration increases. This is because the size of each element is reduced and the influence of one radiation is increased. For example, the document "Single Event Upset Mechanism and Predictions" by James C. Pickle (James
s C Pickel, “SINGLEEVENT UPSET MECHANISM AND PREDI
CTIONS ", Turtorial Short Course IEEE Nuclear and Sp
ace Radiation Effects Conference, Tennessee USA, Jul
y 1983)), p. 56, FIG. 59, shows that the bulk CMOS memory device is 0, 3 .mu.m less than when it is manufactured by a 5 .mu.m process.
When manufactured by the m process, the single event upset occurrence rate is 10 times ( ^10-6 (times / bit / day) to ^10-5 (times / bit / day) in the worst case. At this time, the reliability of the memory device for 10,000 days (the probability of operating without generating a single event for 10,000 days) is R (5 μm) = 0.99 in the case of the 5 μm process, but is in the case of the 0.3 μm process. Is R (0.3 μm) = 0.9, and the reliability is reduced. However, this reduction in reliability can be compensated for by multiplexing. The reliability Rv (0.3 μm) when a memory device is tripled by a 0.3 μm process and the majority of data read from the memory device is determined is Rv (0.3 μm) = 3R (0.3 μm) ² −2R (0.3 μm) ³ = 3 x 0.81-2 x 0.729 = 0.972. That is, when the memory device is integrated by the 0.3 μm process, the reliability can be obtained at the same time as the memory device manufactured by the 5 μm process by making the memory device triple.
Moreover, considering the chip area, tripled 0.3 μm
The memory device for the process is 3 × (0.3 μm) ² / (5 μm) ² = 0.0108 as compared with the memory device for the 5 μm process. Although the triple memory device requires a majority circuit, the area of the majority circuit is smaller than that of the memory device, so that the total chip area is much smaller than that of the conventional memory device.

In other words, the multiplexing (redundancy) can reduce the chip area of the redundant system beyond the multiplicity (the number of redundant systems), and can reduce the overall chip area. This reduction in chip area leads not only to a reduction in physical size but also to a reduction in weight and power consumption. Further, since a general high integration technology can be applied, the development process and the development manufacturing cost of the system are greatly reduced.

If latch-up occurs in the non-transient / dose countermeasure section, power supply control means that shuts off the power supply for a certain period of time and then turns it on again can be provided to prevent element destruction due to excessive latch-up current, and The normal operation can be resumed by recovering from the latch-up during the cutoff. By shutting off and re-inputting power not for the entire system but for each redundant system in which latch-up has occurred, for each part of the redundant system, or for each element,
It is possible to continue processing at a location where no latch-up has occurred. In addition, by limiting the elements to be subjected to the transient dose countermeasures, the target elements are limited to buffers and the like, and the development and manufacturing costs are greatly reduced due to economies of scale.

FIG. 1 is a configuration diagram of an environment-resistant electronic device mounted on a spacecraft or a reactor robot according to a first embodiment of the present invention. This environment-resistant electronic device has an N-layer configuration, and redundant systems 1-1 to 1-N are connected by a communication path 8. In each of the redundant systems 1-1 to 1-N, a process in which only the element group of the interface unit 2 (hatched portion, hereinafter also referred to as a countermeasure unit) connected to the communication path 8 is subjected to a transient dose countermeasure. The other element groups (open areas) are transient and
High integration is achieved by integration technology without taking dose measures.
Now, it is assumed that the element integration degree of this highly integrated portion (hereinafter, also referred to as a non-measurement portion) is M times the element integration degree of the countermeasure portion 2. When the degree of element integration is increased, the reliability is reduced as described above. To compensate for this, it is necessary to at least have an N-fold configuration (N <M) as in this embodiment.

FIG. 2 is a configuration diagram of an environment-resistant electronic device according to a second embodiment of the present invention. The environment-resistant electronic device of the first embodiment includes:
When latch-up occurs in any of the redundant systems, it may be necessary to shut down the power supply of the entire system and turn it on again after a predetermined time. In this case, continuity cannot be maintained in the operation of the system, and the processing must be interrupted. Therefore, in the second embodiment, each of the redundant systems 1-1 to 1-1
Latch-up detection circuits 11-1 to 11-N and power supply control means 12-1 to 12-N are provided for 1-N. Then, only the redundant system in which the latch-up has occurred cuts off the power supply from the power supply bus 10 and connects the power supply bus 10 to the redundant system after a predetermined time, thereby preventing the redundant system from being damaged by an excessive current. By continuing the operation of another normal redundant system, interruption of the processing is avoided. According to the present embodiment, the power supply is cut off only to the redundant system in which the latch-up has occurred. Therefore, the system operation as a whole by the latch-up is replaced by the other redundant system in which the latch-up has not occurred. There is no stop and continuous processing becomes possible.

FIG. 3 shows the latch-up detection circuit 11-i shown in FIG.
FIG. 4 is a detailed configuration diagram of a power supply control unit 12-i. The latch-up detection circuit 11-i includes an impedance element 22 inserted between the corresponding redundant system 1-i and the power supply control means 12-i.
A transistor 23 that outputs a detection value 21 corresponding to a current flowing through the impedance element 22;
It comprises a bias power supply 27 and bias resistors 25 and 26 that reduce the voltage drop between both terminals of the impedance element 22 and operate the transistor 23 even if the voltage between both terminals of the impedance element 22 is small.

The power control means 12-i includes a switch means 30 and a holding means.
Consists of 40. The switch means 30 has an emitter connected to the power supply bus 10 via a latch-up detection circuit 11-i.
Switch transistor 31 with collector connected to i
And the base resistance 32 of the transistor 31.

The holding means 40 is composed of two transistors 41 and 42, two resistors 43 and 44, and two capacitors 45 and 46.
The detection output 21 of -i is input.

If no latch-up has occurred, detection output 21
Is small, the transistor 41 is off. Therefore, the transistor 42 is turned on, the transistor 31 of the switching means 30 is turned on, and the redundant system 1-i is connected to the power bus 10.

When a latch-up occurs in redundant system 1-i, power supply bus
An excessive current flows from 10 to the redundant system 1-i, the detection output 21 increases, and the transistor 41 is turned on. As a result, the transistor 42 is turned on and the transistor 31 is turned off, and the redundant system 1-i is cut off from the power bus 10.

When the latch-up phenomenon disappears and the detection output 21 decreases, the potential of the capacitor 45 charged up to that time is applied to the base of the transistor 41, and the power supply cutoff state of the redundant system 1-i is maintained. When a predetermined time determined by the time constant of the capacitor 45 and the resistor 43 elapses, the base potential of the transistor 41 decreases, and the transistor 41 transitions to an off state,
As a result, the transistor 42 is turned on, the transistor 31 is turned on, and the redundant system 1-i is connected to the power bus 10
Will be reconnected.

The second embodiment shown in FIG. 2 is provided with a latch-up detection circuit and power supply control means for shutting off and re-entering power for each of the redundant systems 1-i. A configuration in which power is turned off and turned on again for each element can also be adopted. FIG. 4 shows an embodiment in which the detection sensitivity of the latch-up current is improved. The redundant system 1-i is divided into load groups 4-a to 4-n, and a latch-up detection circuit 50- is provided for each load group.
a to 50-n are provided, and the OR of the detection output of each latch-up detection circuit is taken by an OR gate 60, and the output of the OR gate 60 operates the holding means 40 to control the switch means 30.

In the embodiment described below, the means for turning off the power and turning on the power again are the same, but since the description is duplicated,
Illustration and explanation are omitted.

FIG. 5 is a configuration diagram of an environment-resistant electronic device according to a third embodiment of the present invention. In the present embodiment, each redundant system 1-i is connected to the control circuit 5 which is a single unit via the communication path 8. Only the element group constituting the control circuit 5 which is a single unit and the element group constituting the interface unit 2 connected to the communication path 8 of each redundant system 1-i are subjected to the transient
Taking measures against the dose, the other components (white portions) of the redundant system 1-i are highly integrated by a normal integration technique.

FIG. 6 is a configuration diagram of an environment-resistant electronic device according to a fourth embodiment of the present invention. In this embodiment, each redundant system 1-i is connected to each other via a bus 6, and each redundant system 1-i is connected to each other.
Only the element group 2 at the connection point of the i to the bus 6 is subjected to a transient dose countermeasure. In the non-measures section, the degree of element integration is increased, and the system is reduced in size and weight.

In the fourth embodiment, each redundant system is connected by the bus 6. However, the present invention is not limited to the bus, and even in a system in which redundant systems are connected by various types of networks, the interface of each redundant system is used. It is needless to say that an effect equivalent to that of the present embodiment can be obtained by applying a transient dose countermeasure only to the portion.

FIG. 7 is a configuration diagram of an environment-resistant electronic device according to a fifth embodiment of the present invention. In this environment-resistant electronic device, a redundant system has a hierarchical structure, and a bus 6'-i is provided below each of the redundant systems 1-i constituting an upper hierarchy connected through the bus 6.
Redundant system 1-i- constituting the lower hierarchy connected through
There are 1-1-i-M. In both the upper-layer redundant system and the lower-layer redundant system, the element group constituting the interface unit 2 connected to the bus is subjected to a transient dose countermeasure, and the other parts are highly integrated as non-countermeasure units. Also in this embodiment, measures are taken only in the interface section so that the influence of the transient dose does not spread to other parts, and the other areas are highly integrated, so that the whole system can be reduced in size and weight.

FIG. 8 is a configuration diagram of an environment-resistant electronic device according to a sixth embodiment of the present invention. In this embodiment, the control circuit 5 connected to the redundant system is made N-fold, and the control circuits 5-1 to 5-N are connected to the bus 6 via the bus interface circuits 9-1 to 9-N, respectively. I have. Then, a transient dose countermeasure is applied to the interface unit 2 of each redundant system, each control circuit, and each bus interface circuit, and high integration is achieved by using other areas of each redundant system as non-measures.

FIG. 9 is a configuration diagram of an environment-resistant electronic device according to a seventh embodiment of the present invention. Compared with the sixth embodiment, in this embodiment, a transient dose countermeasure is applied only to each bus interface circuit 9-i, and the control circuit 5-i and each redundant interface unit 2 are also highly integrated as non-countermeasure units. It is trying to make it. When a measure against transient dose is applied to the bus interface circuit, it is not necessary to apply the measure to the entire bus interface circuit, but only to the element group at the connection point with the bus 6.

As in the sixth and seventh embodiments, by taking measures against the transient dose in the bus interface circuit, malfunction of the bus interface circuit due to the influence of the transient dose can be avoided. In the case where the above-described power cut-off and power-on functions are added to the sixth and seventh embodiments, a power cut-off means or the like is provided for each redundant system group connected to each control circuit, so that transients can be provided. -The effect of the dose can be contained within the redundant group, and the influence on the entire system can be prevented.

FIG. 10 and FIG. 11 are internal configuration diagrams of the redundant system. The redundant system in this example includes a microprocessor 101 and a ROM 10
2, the RAM 103, and the interface 105 are connected to the local bus 10
It is connected to each other by 0, and has the same configuration as a normal computer. Further, the redundant system includes various error detection circuits 10 such as a watchdog timer provided for detecting runaway of the redundant system in a fault-tolerant system.
4 is connected to the local bus 100. In the fault-tolerant system, the error correction code EC is stored in the RAM 103.
C is often added. The redundant system and the external bus 6 are connected via a buffer 106 connected to the interface 105.

In the example of FIG. 10, only the buffer 106 is subjected to a transient dose countermeasure. Since no latch-up occurs in the buffer 106, the buffer 106 is
By adopting the interface unit 2) shown in the figure, it is possible to prevent the influence of the latch-up on other redundant systems.

In the example shown in FIG. 11, a transient dose countermeasure is applied to the interface 105 in addition to the buffer 106.
In the interface 105, since latch-up, single-event upset, and the like do not occur, the influence of these does not affect other redundant systems.

It is needless to say that the watchdog timer 104, the ECC encoding / decoding circuit, and the like may be provided with a transient / dose countermeasure in order to more fully perform error detection in the redundant system.

According to each of the above-described embodiments, the fault-tolerant technology is combined with the process in which transient dose measures are taken, and only a part of the system is subjected to transient dose measures, so that the element integration of most other non-measures parts is performed. The degree of integration can be increased by ordinary integration technology and a multiplexed configuration can be achieved, so that the entire system can be reduced in size and weight without deteriorating the reliability of the system, and the area of transistors constituting a logic circuit can be reduced. As a result, power consumption can be reduced, and the operation can be speeded up. In addition, the already developed parts and the development results thereof can be directly applied to the non-measures part, so that the development process can be shortened and the development cost can be reduced.

[Effects of the Invention] According to the present invention, low cost, small size and light weight that can be manufactured by applying the recent high integration technology as they are,
It is possible to obtain an environment-resistant electronic device in which the influence of the transient dose does not affect the entire system. Further, the continuity of the system operation can be maintained without shutting off the power supply of the entire system when the latch-up occurs.

[Brief description of the drawings]

FIG. 1 is a configuration diagram of an environment-resistant electronic device according to a first embodiment of the present invention, FIG. 2 is a configuration diagram of an environment-resistant electronic device according to a second embodiment of the present invention, and FIG. FIG. 4 is a detailed configuration diagram of the latch-up detection circuit and the power supply control means shown in FIG. 4, FIG. 4 is another configuration diagram of the power supply control means, and FIG. 5, FIG. 6, FIG. 7, FIG. FIG. 10 is a configuration diagram of an environment-resistant electronic device according to the third, fourth, fifth, sixth, and seventh embodiments of the invention; FIGS. 10 and 11 are internal configuration diagrams of a redundant system in another embodiment; 12 and 13 are configuration diagrams of a conventional environment-resistant electronic device, and FIGS.
FIG. 16 and FIG. 16 are explanatory diagrams of the problems of the conventional environment-resistant electronic device. 1-i Redundant system, 2 Interface unit (transient / dose countermeasure unit), 5 Single unit (output switching circuit, majority circuit), 6 Bus, 8 Communication channel, 10
Power bus, 11-i ... Latch-up detection circuit, 12-i ...
... power control means, 30 switch means, 40 holding means.

──────────────────────────────────────────────────続 き Continuation of the front page (56) References JP-A-60-138939 (JP, A) JP-A-59-16199 (JP, A) JP-A-1-283954 (JP, A) JP-A-63-1988 73436 (JP, A) Japanese Utility Model Showa 64-24464 (JP, U) Japanese Utility Model Showa 64-57537 (JP, U) (58) Fields investigated (Int. Cl. ⁷ , DB name) G06F 11/16-11 / 20 G11C 11/34-11/40 H01L 21/00 H01L 27/00 G21C 17/00-17/14 G05B 19/18-19/46

Claims (6)

(57) [Claims] 1. An environment-resistant electronic device having a multiplexed redundant system in addition to a single unit constituted by an element formed by a process in which a measure against a transient dose is taken, wherein the redundant system comprises a redundant system. And the interface connecting between the redundant system and the single unit is constituted by an element formed by a process taking measures against transient dose, and the other components other than the interface of each redundant system are subjected to transient dose. It is configured by an element by a process that does not take a measure, and the element integration degree of a component part configured by an element by a process that does not take a transient dose measure of each of the redundant systems is made up of an element by a process that takes the transient dose measure. M times as large as the element integration degree of the component part, and measures against the transient dose of the redundant system should be taken. N redundant configuration which compensates the reliability of the structure portion constituted by the element by a process (N <M) and to environmental resistance electronic device, characterized in that the. 2. An environment-resistant electronic device comprising a single unit having no redundant configuration and a multiplexed redundant system, wherein the interface unit of the redundant system and the single unit are subjected to a transient dose countermeasure. In addition, the redundant interface unit and the single unit other than the single unit are constituted by elements not subjected to the transient dose countermeasures, and the elements constituted by the process not subjected to the redundant system transient dose countermeasures. The device integration degree of the configured component is set to M times the device integration density of the single unit, and the reliability of the component configured by the process using no process for taking measures against the transient dose of the redundant system is compensated. An environment-resistant electronic device having an N-fold configuration (N <M). 3. The power supply according to claim 1, wherein at the time of occurrence of latch-up, the power supply is shut off for all or a part of the redundant system related to the latch-up or for each element, and is turned on again after a predetermined time. An environment-resistant electronic device comprising a control unit. 4. An environment-resistant electronic device to be placed in a radiation environment, wherein a second circuit portion not subjected to a transient dose countermeasure is provided in addition to a first circuit portion subjected to a transient dose countermeasure. At least a part of the portion has a redundant configuration, and the element density of the second circuit portion is M times the element density of the first circuit portion, and the second circuit portion has an N-layer configuration for compensating the reliability. An environment-resistant electronic device, wherein (N <M). 5. A spacecraft equipped with an electronic device placed in a space environment and performing various electronic controls, wherein the environment-resistant electronic device according to claim 1 is mounted as the electronic device. A spacecraft characterized by the following. 6. A nuclear reactor robot operating under the control of an electronic device under a radiation environment, wherein the environmentally resistant electronic device according to claim 1 is mounted as the electronic device. A reactor robot characterized by the following: